Getting Data In
Highlighted

Compare 2 field values from different sources.

Communicator

Scenario
We process emails looking for order numbers (ON). We need to be able to compare the order numbers we seen in the emails to our database. We're looking for matching and not matching order numbers.

How the data looks.
ONemail: 123, 234, 345, 456
ON
database: 123, 098, 456

Order numbers that match (seen in both database and emails): 123, 456
Order numbers only seen in database: 098
Order numbers only seen in emails: 234, 345

index = a OR index = b | table ON_email ON_database<< This works and shows all the data.
But when i try to compare i can't see any data.

Any ideas?

0 Karma
Highlighted

Re: Compare 2 field values from different sources.

Esteemed Legend

Try this:

index = a OR index = b | eval ON=coalesce(ON_email, ON_database) | stats dc(index) values(index) BY ON

Or maybe this:

index = a OR index = b | eval ON=coalesce(ON_email, ON_database) | stats values(ON) BY index
0 Karma
Highlighted

Re: Compare 2 field values from different sources.

Legend

Try this

index = a OR index = b | makemv ON_email delim="," | makemv delim=","  ON_database | eval ON=coalesce(ON_email, ON_database) | mvexpand ON | stats values(ON) by index
0 Karma
Highlighted

Re: Compare 2 field values from different sources.

Legend

try this:

| eval count=0 | append [ search  | stats count by order_number ] | stats sum(count) AS Total | where Total>0

in this way you can find the result of the first search that are also in the second one.
Be careful: the field name must be the same in both the searches, id they aren't, rename one of them.
Bye.
Giuseppe

0 Karma
Highlighted

Re: Compare 2 field values from different sources.

Legend

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.